Attack Chain

1. An attacker targets industrial control systems or smart building infrastructure utilizing KNX Protocol Connection Authorization Option 1.
2. The attacker identifies specific vulnerable devices that have KNX Protocol Connection Authorization Option 1 enabled but lack additional vendor-recommended security configurations.
3. The attacker initiates a series of deliberate, repeated, and failed authentication attempts against the targeted KNX devices to trigger the overly restrictive account lockout mechanism.
4. The flawed KNX protocol implementation, in response to the lockout condition, incorrectly purges all existing device configurations and settings from the compromised devices.
5. Following the configuration purge, the attacker exploits the underlying vulnerability to establish unauthorized control over the device's Bus Coupling Unit (BCU) key.
6. The attacker then sets a new, malicious BCU key on the affected KNX devices, effectively reconfiguring their access credentials.
7. The newly set BCU key locks the devices, making them inaccessible and inoperable to legitimate administrators and users.
8. This exploitation results in a denial of service for the KNX devices and irreversible data destruction due to the configuration purge.

Impact

Successful exploitation of CVE-2023-4346 leads to severe operational disruption and data loss within affected KNX-based systems. Attackers can purge all device configurations, effectively wiping critical operational settings. Following this, the ability to set a BCU key means legitimate users and administrators are locked out, rendering the devices inoperable. This results in a complete denial of service for the affected infrastructure, potentially impacting smart building automation, industrial control systems, and other critical functions. The vulnerability's presence in CISA's KEV catalog underscores its critical nature and confirmed real-world exploitation, necessitating urgent mitigation to prevent widespread operational failure.

Recommendation

• Apply mitigations in accordance with vendor instructions for KNX Protocol Connection Authorization Option 1 to address CVE-2023-4346 immediately.
• Ensure compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance by patching CVE-2023-4346 on all affected systems by the due date of 2026-07-29.
• Evaluate each asset's internet exposure and ensure adherence to BOD 26-04 patching guidelines to protect devices utilizing KNX Protocol Connection Authorization Option 1.
• If vendor mitigations for CVE-2023-4346 are unavailable, consider discontinuing use of the affected product or isolating it from critical networks.